This was working until we recently upgraded to 7.x-1.0-alpha3. Symptom was that as an anonymous user, it was not possible to view nodes that we otherwise had access to (eg. visiting http://site/node/$nid works fine but http://site/api/node/$uuid.json would return a 403 Permission Denied error).
This appears to be an issue with _uuid_services_entity_access setting $entity to NULL on line 166 unless $arg[2] is set (ie. only if it's part of an update), but then using entity_access($op, $entity_type, $entity); on line 185 which always returns false if a specific entity is not provided:
$ drush ev "var_dump(entity_access('view', 'node', NULL));"
bool(false)
$ drush ev "var_dump(entity_access('view', 'node', current(entity_load('node', array(107)))));"
bool(true)
Fix was to always load the entity when checking access. I'm not intimately familiar with UUID's inner workings so I'm not sure if this has any unforeseen effects elsewhere, but it worked for our use case.
| Comment | File | Size | Author |
|---|---|---|---|
| uuid_services-access-load-entity.patch | 749 bytes | garethsprice |
Comments
Comment #1
dixon_I see, good catch. Your logic seems reasonable, but I'm gonna look into this some more and see what's the most solid solution.
Comment #2
dixon_I've now implemented some improved logic to handle the case mentioned in the OP. It only loads the entity if it's not provided by the request (being an update).
Should work pretty well according to my manual testing. I am going to post an issue about writing simpletests for uuid_services. We need that.
Comment #3.0
(not verified) commentedUpdated to include line numbers